Liquid Network halts operations after $320 million bitcoin exploit by alleged white-hat hackers

On September 6, 2026, Liquid Network suspended operations after self-described white-hat hackers exploited a software bug in Blockstream's Elements framework, draining 4,000 Bitcoin worth $320 million—about 95% of its reserves. The exploit bypassed cryptographic keys, generating unbacked L-BTC processed via SideSwap. The hackers are negotiating onchain, promising to return the funds once all nodes are patched, while the incident raises concerns over federated sidechain security.

Liquid Network exploit

• ▪To contain the September 6, 2026 exploit, Liquid Network disabled its bridge nodes to prevent new transactions, and participating exchanges suspended L-BTC deposits and withdrawals.
• ▪Alternative digital assets hosted on Liquid Network, including Tether (USDT), DePix, and tokenized real-world assets, were unaffected by the September 6, 2026 security incident.
• ▪Liquid Network suspended all network activity on September 6, 2026, after actors claiming to be white-hat hackers withdrew approximately 4,000 Bitcoin worth $320 million.
• ▪The September 6, 2026 suspension of Liquid Network impacted the Liquid functionality of JAN3's Aqua Bitcoin wallet, though standard Bitcoin transactions remained operational.
• ▪The withdrawal of approximately 4,000 Bitcoin on September 6, 2026, represented roughly 95% of the 4,200 Bitcoin held in Liquid Network's federation wallet.

Elements software vulnerability

• ▪Samson Mow, CEO of JAN3, stated that the working theory for the September 6, 2026 exploit is a node-level vulnerability within Liquid Network's Confidential Transactions processing software.
• ▪The September 6, 2026 exploit of Liquid Network did not involve compromised cryptographic keys, passwords, or hardware security modules.
• ▪Blockstream determined that the September 6, 2026 exploit was caused by a software bug in Elements, the open-source framework underlying Liquid Network, which allowed the generation of unbacked L-BTC.

White-hat hacker negotiations

• ▪The actors responsible for the September 6, 2026 exploit communicated with Blockstream through messages embedded in onchain Bitcoin transactions.
• ▪The self-described white-hat hackers promised to return the stolen Bitcoin safely after Blockstream patches the Elements software vulnerability and updates every node.
• ▪Ledger Chief Technology Officer Charles Guillemet questioned the hackers' methods during the September 6, 2026 incident, noting that asking to be contacted on Signal is unusual for typical white-hat practices.
• ▪According to Galaxy Digital's head of research, Alex Thorn, the hackers who exploited Liquid Network on September 6, 2026, transmitted encrypted technical documentation to Blockstream to assist in remediation.

SideSwap peg-out service

• ▪SideSwap stated that its Peg-out Authorization Key was not compromised during the September 6, 2026 exploit and that its service could not distinguish between legitimately backed coins and those generated via the Elements bug.
• ▪The stolen funds from the September 6, 2026 exploit were processed as a customer order through SideSwap's peg-out service, which burned 4,000 L-BTC and paid out 3,996 BTC.

Federation wallet security model

• ▪Liquid Network is overseen by a federation of more than 80 entities, including cryptocurrency exchanges, blockchain infrastructure firms, and asset managers.
• ▪The September 6, 2026 drain of nearly the entire Bitcoin reserve has raised concerns within the cryptocurrency community regarding the security architecture of federated sidechain models.
• ▪Blockstream launched Liquid Network in 2018 as a Bitcoin sidechain to enable faster transaction settlements for exchanges by issuing L-BTC pegged 1:1 to Bitcoin locked in reserve.

Debatable claims

• ▪Federated sidechains pose unacceptable security risks for Bitcoin
• ▪The Liquid Network exploiters should be recognized as ethical white-hat hackers
• ▪Liquid Network's emergency halt undermines the core principles of decentralized finance